Shall I cough on you, George?

On my XP machines, I run Norton AntiVirus 2003 and hope not to be bothered. In addition, I manually run Ad-aware because of Symantec's stance regarding trojans and spyware (they're not viruses, hence Norton doesn't bother to protect against them).¹

Well, this apparently wasn't enough. For the past two days, I've had various horrible symptoms: home page hijacks, toolbar reconfigurations, popups when no browser is running and other irritating things as well. I update Norton and scan: nothing. Update Ad-aware, and get all sorts of malware detected, which Ad-aware removes. But the symptoms reappears some time later.

I check the websites that the pop-ups and hijack destinations reference, nothing interesting and googling them yields nothing either. Trend Micro's HouseCall ActiveX-based malware scanner doesn't run at all — IE crashes.

Without any clues other than the fact that HouseCall won't run (suspicious in itself) I download the trial version of Trend Micro's stand-alone antivirus product, PC-cillin. Interestingly, the installer refuses to run unless Norton is uninstalled! After some thrashing around, I decide to uninstall Norton and install PC-cillin. After installing and updating PC-cillin I get to run it. Immediately, it finds TROJ_AGENT.AC and JAVA_BYTEVER.A.² Problem solved.

This experience doesn't give me a whole lot of faith in Norton. I do get a giggle, though, from the thought of a silent war for disk space between software trial versions.

[1] This policy was changed in the 2004 version.

[2] Turns out what my PC had was the CoolWebSearch hijack trojan which uses the ByteVerify exploit in the MS Java VM and is notoriously difficult to get rid of.